Debian Security Advisory
DSA-4030-1 roundcube -- security update
- Date Reported:
- 09 Nov 2017
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2017-16651.
- More information:
A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. An authenticated attacker can take advantage of this flaw to read roundcube's configuration files.
For the stable distribution (stretch), this problem has been fixed in version 1.2.3+dfsg.1-4+deb9u1.
For the unstable distribution (sid), this problem has been fixed in version 1.3.3+dfsg.1-1.
We recommend that you upgrade your roundcube packages.